Is SOC 2 a certification?
No. It's an auditor's report
The free checklistThe SOC 2 access checklist
The SOC 2 access checklist
for agencies
Who can touch production, and who approved it
The video, without the music
The short answer
What SOC 2 means for the app you built
SOC 2 is a report, not a law or a certificate. An outside auditor checks how a company protects its customers' data. A Type 1 report covers one day, and a Type 2 covers months. When your client goes for one, the auditor looks at the app you built and asks who can reach production and who approved that access. A shared login nobody turned off after handoff becomes a finding against your client.
Type 1 or Type 2?
Type 1 checks that the controls were designed right on one day. Type 2 checks that they kept working over a period, usually 3 to 12 months
Do AI coding agents count?
Yes. Any agent or MCP server with database or deploy access is access the auditor will ask about
SOC 2 in plain English
What it is, and why it lands on you
What SOC 2 is
A report under the AICPA's Trust Services Criteria, written by an outside auditor. Bigger US customers ask for it before they sign
Why it lands on you
Your accounts, keys and deploy paths are part of what the auditor reviews when your client goes for the report
What Claude can check
Every person, key, service account and AI agent that can reach production, what each one can read or write, and where it is defined. It also flags the risky ones: shared logins, keys in git history, leftover agency accounts and deploys without review
What Claude can't check
Who signed off on each access, and the months of proof a Type 2 report needs. That record lives outside the code
In the full checklist
What the checklist gives you
The full access review prompt
Ready to copy into Claude. It reads your code and settings and changes nothing
Six things to look for
The findings an auditor writes up against your client
What you can ignore
So you don't chase keys that are safe by design
Handoff steps and proof
What to turn off at handoff, and the record a Type 2 checks for months
Free, no call
Get the full SOC 2 checklist
The prompt to give Claude, what to look for in its answer, what you can ignore, and the proof you have to keep for the auditor
Keep readingEvery post
The GDPR checklist for agencies that build client apps
If your client has users in Europe, GDPR applies to the app you built for them, even from the US. Find every copy of your users' data before your client asks you to delete it
The HIPAA checklist for building apps for clinics
If you build an app for a US clinic, you sign a BAA before you touch patient data, and so does every service your app sends it to, including the ones Claude wired in
How Minecraft got inside GTA 5
A mod runs Minecraft and GTA 5 at the same time and blends them pixel by pixel. The full breakdown of the mod, with the exact code behind every trick
Fine print
What this page is, and isn't
- This is a technical checklist, not legal advice. For your situation, talk to a lawyer or your client's compliance lead.
- The Claude prompts only read your code and report back. They don't change anything.
- The page explains the rules in plain English. The law and the auditor's criteria are the final word, linked below.
Building an app that has to pass a check like this
An engineer checks it, fixes it, tests it and puts their name on it
- 30 minutes
- Free
- No slides, no sales team